cyber risk
Source: Canva

For a small UK business, a cyber attack rarely begins with a movie-style hacker breaking through a complicated firewall. More often, the first move is much simpler: someone steals a login, tricks an employee into entering credentials on a fake sign-in page, or uses a password exposed somewhere else.

That helps explain why credential theft remains one of the most serious security risks for UK SMEs in 2026. The latest UK government figures put phishing firmly at the top of the business threat picture, while global breach data continues to place compromised credentials among the leading routes attackers use to get inside an organisation.

For small firms, this creates an awkward security gap. Many have adopted basic password policies, yet far fewer have moved to stronger authentication across the accounts their businesses depend on.

The government's latest Cyber Security Breaches Survey found that 74% of UK businesses have a password policy, while only 47% use two-factor authentication for networks or applications.

This is where Cyber Essentials becomes especially relevant. The scheme gives SMEs a practical baseline for reducing common attack routes, and its technical requirements were updated in April 2026 to reflect the way businesses now use cloud services, remote devices and modern authentication.

What the Latest UK Cyber Data Tells Us About SME Risk

The government surveyed 2,112 UK businesses and found that 43% of businesses had identified at least one cyber security breach or attack during the previous 12 months, equivalent to roughly 612,000 businesses. Small businesses recorded a 46% breach or attack rate, compared with 42% among micro businesses.

The standout threat was phishing.

38% of businesses experienced phishing, making it by far the most common type of identified cyber attack. Among businesses that had suffered a breach or attack, 88% reported phishing, and 69% said phishing was the most disruptive attack they experienced.

The government survey generally categorises incidents by attack type, so it does not publish a single headline figure called 'credential theft'. Yet phishing is often the mechanism used to steal usernames, passwords and other authentication data. The NCSC describes phishing as a common route into accounts and devices, and explains how stolen passwords can be reused in credential-stuffing attacks.

There is another useful figure. Among the 3% of businesses that experienced cyber-facilitated fraud, 45% linked the incident to phishing, while 14% associated it with a takeover or attempted takeover of a website, social media, or email account. That provides a clearer picture of where stolen access can lead.

Why Stolen Credentials Are So Valuable to Attackers

A password gives a criminal something more useful than access to one application. It can provide a route into an entire business ecosystem.

Think about a typical small company. Email may connect to Microsoft 365 or Google Workspace. The same employee may have access to cloud storage, accounting software, customer records, social media, payroll platforms and the company website.

Once an attacker gets control of an important account, the original phishing email becomes almost irrelevant. The account itself becomes the foothold.

Verizon's 2025 Data Breach Investigations Report, which analysed more than 22,000 security incidents and 12,000 confirmed breaches, found that compromised credentials were an initial access vector in 22% of breaches reviewed. Verizon also reported that stolen credentials were involved in 32% of all breaches covered by its analysis.

Small firms face an additional problem when employees reuse passwords. Verizon's analysis of infostealer data found that, in the median case, only 49% of a user's passwords across different services were unique. That means a password stolen from one service can potentially unlock another.

The NCSC has long warned about this chain. Criminals can collect credentials through phishing, malware or breaches affecting online services, then use those details elsewhere through credential stuffing. Once a business account is compromised, attackers may read confidential emails, change recovery details, impersonate staff or attempt fraud.

Where Cyber Essentials Fits Into the Picture

Cyber Essentials should be viewed as a security baseline, rather than a badge that somehow eliminates cyber risk.

The scheme's current technical requirements, version 3.3, came into effect on 27 April 2026. The framework is organised around five areas: firewalls, secure configuration, security update management, user access control and malware protection.

For the credential problem, the fourth area, User Access Control, deserves particular attention.

The 2026 requirements state that organisations should use multi-factor authentication (MFA) where available, and authentication to cloud services must always use MFA. They also require additional protection for administrative accounts and accounts accessible from the internet.

Password-based authentication must have protection against brute-force guessing, using MFA, controlled login attempts or account/device locking.

This represents an important shift for SMEs that still think of password security as simply choosing a longer password.

The current standard also recognises passwordless authentication, including passkeys based on FIDO2, biometric methods, security keys, push notifications and one-time codes.

For a business moving toward stronger authentication, a password manager can help employees create and store unique credentials instead of recycling familiar passwords between services.

Cyber Essentials Now Covers the Cloud More Clearly

The 2026 Cyber Essentials update also reflects how little of modern business IT sits inside a traditional office.

Cloud services cannot be excluded from scope when they hold organisational data or provide organisational services. Microsoft 365, Google Workspace, hosted applications and other cloud platforms therefore need to be considered as part of the security picture.

Remote working receives similar treatment. Corporate and bring-your-own-device systems used for business activity can fall within scope, while organisations remain responsible for understanding how their staff access company data and services.

Small Businesses Have Improved, but the Gap Remains

The latest UK figures give SMEs some credit. The proportion of small firms reporting adherence to the UK's Cyber Essentials programme rose from 5% last year to 12% this year. Across the broader business landscape, the overall reported adherence rate climbed from 3% to 5%.

The government also recorded 59,090 Cyber Essentials certificates issued between April 2025 and March 2026, including 44,608 Cyber Essentials certificates and 14,482 Cyber Essentials Plus certificates.

Yet the wider figures reveal why certification alone should never be treated as the finish line.

Only 41% of small businesses reported conducting cyber security risk assessments in the latest survey, down from 48% the previous year. Only 52% had a formal cyber security policy, while 44% had a business continuity plan covering cyber security.

The same survey found that just 47% of businesses overall had two-factor authentication, while adoption among micro businesses was 43%. Those figures are a reminder that basic controls may exist on paper while stronger account protection remains inconsistent.

Credential Theft Will Keep Evolving in 2026

The threat has also become more sophisticated.

Microsoft's Digital Defense Report 2025 found that 28% of breaches handled by Microsoft Incident Response began with phishing or social engineering. The report also described a growing ecosystem in which access brokers sell stolen credentials and compromised environments to other criminals, including operators focused on business email compromise and fraud.

That makes the old advice of 'just train staff to recognise suspicious emails' feel incomplete. Training still matters, but attackers now have more convincing ways to imitate legitimate login pages and manipulate users. Technical controls have to carry part of the burden.